# Ensure Any Public Addresses Are Listed in Shodan (Using Shodan API)

- Source: https://support.icompaas.com/support/solutions/articles/62000235334-ensure-any-public-addresses-are-listed-in-shodan-using-shodan-api-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   **Level 2**
    

### **Description****:**

Public IP addresses assigned to your cloud infrastructure should be regularly checked against **Shodan**, a popular internet-wide scanning service, to detect if they are exposed and what services or vulnerabilities are associated with them. This check helps identify unintended exposure and potential security risks.

### **Rationale****:**

-   **Visibility**: Shodan indexes public-facing devices and services, revealing exposed ports, services, banners, and vulnerabilities.
    
-   **Risk Mitigation**: Identifying if your IP addresses appear on Shodan allows you to assess the risk of exposure and remediate any unintended publicly accessible services.
    
-   **Continuous Monitoring**: Regular checks with the Shodan API help maintain a secure attack surface by proactively identifying exposures.
    

### **Impact****:**

-   Helps you detect if your public IPs are exposed and indexed on the internet.
    
-   Enables timely remediation of exposed services or misconfigurations.
    
-   No direct impact on infrastructure but may reveal critical security gaps.
    

### **Default Value****:**

-   No automatic monitoring by default; requires active integration with the Shodan API.
    

### **Prerequisites****:**

-   **Shodan API Key** (requires a Shodan account and API subscription).
    
-   List of public IP addresses to be scanned.
    
-   Environment with internet access to query the Shodan API.
    
-   Optional: scripting environment (Python, Bash, etc.) to automate queries.
    

### **Test Plan****:**

1.  **Collect Public IP Addresses:**
    
    -   Retrieve all public IP addresses used by your cloud infrastructure (e.g., via AWS, GCP, Azure CLI or console).
        
2.  **Query Shodan API for Each IP:**
    
    Use the Shodan API to check if an IP is indexed. For example, using `curl`:  
    
    curl "https://api.shodan.io/shodan/host/\[IP\_ADDRESS\]?key=\[YOUR\_API\_KEY\]"
    
    -   Replace `[IP_ADDRESS]` with the actual public IP.
        
    -   Replace `[YOUR_API_KEY]` with your Shodan API key.
        
3.  **Analyze the API Response:**
    
    -   If the IP is found, Shodan returns details about the host, open ports, services, and vulnerabilities.
        
    -   If the IP is not found, you receive a "404 Not Found" response.
        
4.  **Automate Scanning:**
    
    -   Write scripts to iterate over your list of public IPs and query Shodan API.
        
    -   Aggregate results for review.
        

###   

### **Example Python Script:**

import requests
SHODAN\_API\_KEY = 'YOUR\_API\_KEY'
public\_ips = \['1.2.3.4', '5.6.7.8'\] # Replace with your IP list
for ip in public\_ips: url = f"https://api.shodan.io/shodan/host/{ip}?key={SHODAN\_API\_KEY}" response = requests.get(url) if response.status\_code == 200: print(f"IP {ip} is found in Shodan!") data = response.json() print(f"Open Ports: {\[service\['port'\] for service in data.get('data', \[\])\]}") print(f"Vulnerabilities: {data.get('vulns', 'None')}") elif response.status\_code == 404: print(f"IP {ip} not found in Shodan.") else: print(f"Error querying IP {ip}: {response.status\_code}")

### **Remediation Steps****:**

-   For any public IP found in Shodan:
    
    -   Review the exposed services and ports.
        
    -   Harden or disable unnecessary services.
        
    -   Implement firewall rules or network ACLs to restrict unwanted access.
        
    -   Patch any detected vulnerabilities.
        
-   Schedule regular scans to keep track of exposure.
    

### **Backout Plan****:**

-   No direct impact on infrastructure from the scan.
    
-   If automated scans cause rate limits or API issues, reduce frequency or batch size.
    
-   If any remediation affects business operations, roll back changes following your change management process.
    

### **References****:**

-   Shodan API Documentation
    
-   [Using Shodan to Find Exposed Devices](https://www.shodan.io/)
    
-   Google Cloud CLI to Retrieve Public IPs

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.